11,000 new CVEs this quarter. You can patch 40. Which 40?
Cvekit merges EPSS probability, CISA KEV membership, exploit maturity and ransomware linkage into a single view of real-world pressure, over a record that also carries CVSS v3.1 and v4.0 vectors, affected-version matrices, weakness chains, exploit provenance and threat-actor attribution.
What Cvekit sees
One page, four signals
EPSS probability and its percentile, KEV status, public exploit maturity and ransomware campaign linkage on a single CVE page, each with its history, so you read the trend rather than today's number alone. Severity tells you what could hurt; these tell you what is hurting.
ATT&CK-mapped, advisory-chained
Every CVE links to its ATT&CK techniques, carrying the confidence and the written rationale behind each mapping, plus its CWE-to-CAPEC weakness chain and the vendor advisory graph with fixed versions and workarounds. The patch decision meets your detection strategy on one page.
Affected products, and the fix
Match by product and version range (CPE) or by package (PURL, covering npm, PyPI, Maven and the rest), each pinned to the versions that close it. "Is this one ours, and what do we upgrade to" becomes a single lookup instead of an afternoon.
The neighbourhood around a CVE
From one record you can pivot to the CVEs that share its weakness class, the ones attributed to the same threat actor, and the ones affecting the same vendor and product. A single finding turns into the cluster it belongs to.
Why CVSS alone sends you patching the wrong things
Typical CVEs hug the floor at every severity. Put EPSS on the y-axis and the ones that burn separate instantly. Each named CVE is listed under the plot with its current scores, and links to its live record on cvekit.com.
CVSS × EPSS
sample96.0%
of the 32,771 CVEs rated CVSS 9.0 and above carry an EPSS below 5%: rated critical, forecast never to be exploited.
Scatter plot of CVSS severity against EPSS exploitation probability. Mark size and brightness show how many CVEs fall in each band: the mass sits in the lowest probability band at every severity, and thins to almost nothing above it. Beside the plot, the share of the corpus in each probability band: 75 to 100 percent, 0.1%. 50 to 75 percent, 0.2%. 25 to 50 percent, 0.6%. 10 to 25 percent, 1.2%. 5 to 10 percent, 0.8%. 0 to 5 percent, 96.8%. The named CVEs sit alone in the top right corner, above 88% probability, and are listed with their scores, as links, below the plot.
- 75 to 100%0.1%
- 50 to 75%0.2%
- 25 to 50%0.6%
- 10 to 25%1.2%
- 5 to 10%0.8%
- 0 to 5%96.8%
- 75 to 100%0.1%
- 50 to 75%0.2%
- 25 to 50%0.6%
- 10 to 25%1.2%
- 5 to 10%0.8%
- 0 to 5%96.8%
X · CVSS SEVERITY / Y · EPSS 30-DAY EXPLOITATION PROBABILITY / SHARE OF CORPUS PER BAND
The corpus, in motion
Twelve months of publication volume, and where the corpus lands on the severity scale, with the KEV and public-exploit overlays that mark actual risk. Live from the same index cvekit.com serves.
CVE PULSE
sampleSEVERITY DISTRIBUTION
1.4K on CISA KEV · 8.2K with a public exploit
ILLUSTRATIVE SAMPLE · THE LIVE SERIES REPLACES THIS
FIGURES FLOORED · NEVER ROUNDED UP
Same data, same permissions, over HTTP
Everything the console shows, the API serves. Real endpoint, sample response, masked values.
GET /api/cvekit/v1/cves/{cve_id}
REQUEST
curl -H "X-API-Key: sk_••••••••" \ "https://console.generalintels.com/api/cvekit/v1/cves/CVE-2024-3400\ ?include_history=true&include_intel=true"
RESPONSE · 200
{
"cve_id": "CVE-2024-3400",
"published_at": "2024-04-12T08:15:06Z",
"cvss_v31_score": 10.0,
"cvss_v31_severity": "critical",
"cvss_v40_score": 10.0,
"epss_score": 0.943,
"epss_percentile": 0.999,
"is_kev": true,
"kev_added_at": "2024-04-12T00:00:00Z",
"has_exploit": true,
"exploit_maturity_max": "weaponized",
"has_ransomware_link": true,
"weaknesses": [
{ "source": "nvd", "cwe_id": "CWE-77", "type": "Primary", "capec_ids": ["CAPEC-248"] }
],
"cpe_matches": [
{ "source": "nvd", "cpe_vendor": "paloaltonetworks", "cpe_product": "pan-os",
"vulnerable": true, "version_start_including": "10.2.0" }
],
"exploits": [
{ "source": "exploitdb", "maturity": "weaponized", "published_at": "2024-04-16T00:00:00Z" }
],
"attack_techniques": [
{ "technique_id": "T1190", "technique_name": "Exploit Public-Facing Application",
"confidence": "high", "rationale": "Unauthenticated command injection on the mgmt interface." }
],
"vendor_advisories": [
{ "vendor": "paloaltonetworks", "fixed_versions": ["10.2.9-h1"], "workaround": "Disable device telemetry." }
],
"epss_history": [{ "scored_at": "2024-04-13", "score": 0.943, "percentile": 0.999 }]
}include_history adds the full EPSS time series; include_intel adds the related-CVE lists by weakness, actor and product.
Public index, platform depth
The public library lives at cvekit.com: every CVE on a permanent page with EPSS, KEV and exploit status, free and with no account. The full ATT&CK chains and their rationale, the advisory graph, threat-actor attribution, related-CVE pivots and programmatic access through this API live in the platform.
Full API reference ships with your workspace: every endpoint, versioned.
From feed panic to patch plan
A new edge-device CVE trends on social feeds. CVSS 9.8, as were 400 others this year.
Cvekit shows EPSS at 0.31 and climbing, no KEV yet, PoC published overnight.
The record moves: EPSS crosses 0.80, exploit maturity flips to weaponized, and CISA adds it to KEV.
You move the patch from "next cycle" to "this week", with the score history attached to the change ticket.
Cvekit, honestly answered
The other windows
- SherlogCredential & Cookie Intelligence
- DragnetUnderground Content Intelligence
- MalveineThreat Intel Console & Feeds
- JabbernautMessaging Intelligence · XMPP
- TelepathyMessaging Intelligence · Telegram
- GuildwireMessaging Intelligence · Discord
- BaitbackImpersonation Defense
- SoursOperator Surveillance · Closed briefing
Your competitors will learn about the leak from the invoice.
Learn about it from the log batch.
NDA-friendly briefings · global coverage · no slideware